Privacy Policy

1. Who We Are

GU Analyser is operated by GU Analyser Ltd, Registered in England and Wales under company number 17367615, registered at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. We are the data controller for the personal data collected through this service. GU Analyser is available to users worldwide.

We collect only personal data that is strictly necessary to create your account, process any subscription, and provide support. This applies equally whether you use the free plan or a paid subscription. Beyond that, the only user content we store is what the Service needs in order to work for you: your progress through the learning material, the strategies you choose to save, and your practice-session history, each linked to your account and visible only to you. Market data is cached on our servers to operate the Service efficiently, but this is shared public market data, not personal data about you.

Contact: hello@guanalyser.com

2. What Data We Collect

We collect the minimum data necessary to operate the Service:

• Account data — your email address, provided when you register.
• Subscription data — your plan type and subscription status, provided by Paddle (our Merchant of Record). Free-plan accounts hold a plan status only. We do not store card numbers, bank details, or any payment information.
• Saved content — the trading strategies you choose to save, your practice-session history, and your learning progress (which lessons you have marked as in progress or complete), stored against your account so they are available whenever and wherever you sign in. This content is visible only to you, protected by per-user access controls, and is never analysed, shared, or used for any purpose other than showing it back to you.
• Server logs — IP addresses and API endpoint names for all requests; plus the ticker symbol and date range for analysis and backtesting requests specifically (e.g. AAPL / 2024-01-01 → 2025-01-01). Retained for up to 30 days for security and debugging. Logs do not contain the price data or indicator results returned to you.
• Consent record — the date and version of these Terms you accepted, stored to fulfil our legal obligations.
• Support correspondence — any information you provide when contacting us by email.

What stays in your browser only:

• Your interface preferences and indicator parameter settings

What we do not collect: the results of your chart analyses and backtests are computed on demand, returned to your browser, and not retained by us.

Market data. Market data is never linked to your account and is never shared or redistributed between users.

Website analytics. We use Cloudflare Web Analytics on our public website to count page views and see which pages and referring sites people arrive from. It is privacy-first by design: it sets no cookies, stores nothing in your browser, and does not identify or fingerprint individual visitors. We see aggregate counts, not people. It does not run in the application itself.

We do not use advertising tracking or user behaviour monitoring tools, and we do not use any analytics service that profiles individuals across websites.

3. How We Use Your Data

We use the personal data we hold solely to:

• Create and manage your account
• Verify your subscription status and control access to the Service
• Send transactional emails (account confirmation, password reset, subscription notifications)
• Record your acceptance of our Terms of Service
• Respond to support requests you initiate
• Detect and prevent fraud, abuse, or security threats

We do not use your data for marketing, profiling, advertising, or any purpose beyond operating the Service.

For users in the UK, the applicable lawful bases under the UK GDPR are: contract performance (account management, subscription, transactional email), legal obligation (consent records), and legitimate interests (security and fraud prevention). We do not rely on consent as a lawful basis for any processing.

4. Third-Party Services

We use the following sub-processors and infrastructure providers. Each handles only the personal data necessary for their specific function:

• Supabase — provides authentication and account database storage. Account data is stored on servers in Frankfurt, Germany (the European Economic Area). Supabase Privacy Policy.
• Google — one of the ways you can sign in. If you choose it, Google provides your email address and name so we can identify your account. Google Privacy Policy.
• Email providers — we use third-party email services to send automated messages (account confirmation, password reset) and to receive mail sent to hello@guanalyser.com. Your email address, and anything you write to us, passes through them for that purpose only. We do not use them for marketing.
• Marketstack — provides the market data shown in the Service. No personal data about you is sent to Marketstack. apilayer / Marketstack legal terms.
• Paddle — subscription payments, as our Merchant of Record. Paddle collects and processes billing and payment information directly. Billing data is retained by Paddle subject to their own policies and applicable financial and tax regulations. Paddle Privacy Policy.
• Sentry — error monitoring to help us diagnose software bugs. We configure error reports to exclude personally identifiable information. Reports contain anonymised technical context only (stack traces, browser version, operating system). Sentry Privacy Policy.
• Render — hosts our backend API on servers in Frankfurt, Germany (the European Economic Area). Server request logs (IP addresses, endpoint names, and ticker symbols from analysis requests) are processed on Render's infrastructure. Render Privacy Policy.
• Cloudflare — CDN, frontend hosting, and website analytics on the public site. Request metadata (including IP addresses) may be processed across Cloudflare's global network as part of normal CDN operation. Cloudflare Privacy Policy.

We do not sell, rent, or share your personal data with any third party for marketing, advertising, or profiling purposes.

5. Data Retention

We retain personal data only for as long as necessary:

• Account data and saved content — retained while your account is active. If you cancel your subscription or stop using the Service, we keep your account, saved strategies, practice history and learning progress for as long as your account exists, so that they are still there if you come back and resubscribe rather than starting again. We do not delete them on a timer — if you want them gone, delete your account and your saved content goes with it, immediately and permanently — apart from the limited records below that we are required to keep.
• Deletion on request — you do not have to wait. Ask us at any time and we will delete your account and the content stored against it, keeping only what we are legally required or permitted to retain. See Section 6.
• Google sign-in — if you used it, you can also remove GU Analyser's access from your Google account permissions.
• Server logs — retained for up to 30 days, then deleted or anonymised.
• Consent records — retained for as long as required to demonstrate compliance with our legal obligations.
• Billing data (held by Paddle) — retained by Paddle subject to their own policies and applicable financial and tax regulations, which may require retention for several years. This is outside our control.

We keep inactive accounts on the basis of our legitimate interest in letting returning customers pick up where they left off. There is no fixed period and nothing is deleted automatically: your account and its content stay until you remove them. Ask us to erase your data at any time and we will, and we will not keep a copy to hold your place.

6. Your Privacy Rights

We honour privacy rights for all users regardless of location. To protect your account, we may ask you to verify your identity before we process any request. We will not charge you for exercising your rights. We will respond within one month; for complex requests we may extend this by a further two months and will notify you if so.

UK residents (UK GDPR) — you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — correct inaccurate or incomplete data
• Erasure — request deletion of your data ("right to be forgotten")
• Portability — receive your data in a structured, machine-readable format
• Objection — object to processing carried out on the basis of legitimate interests
• Restriction — request that we restrict processing of your data

If you are dissatisfied with how we handle your data, UK residents may lodge a complaint with the Information Commissioner's Office (ICO). GU Analyser Ltd is registered with the ICO as a data controller, registration number ZC210697.

Everyone else — GU Analyser is operated from the United Kingdom and we apply the same standards to every user, wherever you live. You may ask us for a copy of your data, ask us to correct it, or ask us to delete it. We do not sell it or share it for marketing, advertising or profiling. You will never be treated differently for exercising any of these rights. You may also have additional rights under your own local law — tell us and we will do our best to accommodate the request.

All users — to exercise any of the above rights, email hello@guanalyser.com.

7. Cookies and Browser Local Storage

Cookies. GU Analyser sets no cookies of its own. Your sign-in session is kept in your browser's local storage rather than in a cookie (see below). Our CDN provider, Cloudflare, may also set technically necessary infrastructure cookies (such as a bot-management cookie) as part of normal network operations. We do not use advertising cookies, tracking cookies, or any third-party analytics cookies.

Browser local storage. GU Analyser stores the following data in your browser's local storage on your device:

• Authentication session information — used to keep you securely signed in
• Your application settings and preferences (e.g. indicator parameters)
• In-session state such as selected timeframes and chart selections
• Locally cached chart data for faster navigation
• A display preference, if you choose to continue to the full site on a small screen

This locally stored information remains in your browser and is not stored on our servers.

Important: locally stored preferences exist only in your current browser profile and are not synced across devices or browsers. They will be reset if you clear site data for this website or reset your browser profile. Preferences set during a private or incognito browsing session are also not saved once that window is closed.

8. Security

All data in transit between your browser and our servers is encrypted using HTTPS. Account passwords are managed by Supabase Auth using industry-standard hashing; passwords are never stored in plain text and are never accessible to us.

Your analysis results are never shared with other users or redistributed. Saved strategies, practice history and learning progress are stored in your account database, protected by per-user access controls (row-level security), so only your own account can read or change them. We do not store the results of chart analyses or backtests — those are computed on demand and returned to your browser. Ticker symbols submitted with analysis requests appear in server logs, retained for up to 30 days as described in Section 2.

We apply reasonable technical and organisational security measures appropriate to the nature and volume of personal data we hold. No system can guarantee absolute security, and we cannot accept liability for unauthorised access that is beyond our reasonable control.

9. International Data Transfers

GU Analyser is operated from the United Kingdom and may serve users globally. Different parts of the Service involve data being processed in different locations:

• Supabase — account and authentication data is stored on servers in Frankfurt, Germany (the European Economic Area).
• Render — our backend API runs on servers in Frankfurt, Germany (the European Economic Area). Server request logs (IP addresses, endpoint names, ticker symbols) are processed there.
• Cloudflare — as a global CDN, request metadata may be processed in multiple countries as part of normal traffic routing.
• Paddle — processes billing data across multiple jurisdictions subject to their own transfer safeguards.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes to our practices or legal requirements. We will notify you of significant changes by email before they take effect. The current version is always available at guanalyser.com/privacy/.

11. Contact

For any privacy-related questions or to exercise your rights:
hello@guanalyser.com
GU Analyser Ltd, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom